Require approval for awk and sed bash commands / 要求 awk 和 sed Bash 命令审批

[SivanCola]

Summary

• Treat awk and sed bash commands as approval-required instead of read-only.
• Add regression cases for awk system(), awk file writes, and sed e command execution.

Problem

The bash read-only classifier allowed awk and sed based only on the command name. Those tools can execute shell commands or write files from inside their scripts, so classifying them as read-only could bypass Ask-mode approval.

Verification

• go test ./internal/permission ./internal/agent -count=1
• go test ./internal/sandbox ./internal/tool/builtin -run 'TestSandboxEnforcesWrites|TestBashSandboxConfinement' -count=1